registry / @su-record/vibe / 4.2.23

@su-record/vibe@4.2.23

Your personal FDE in Claude and Codex. Understand the work, use the right tools, deliver and retain useful context. One entry: vibe.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The postinstall automatically sets up Vibe's own agent integration for global npm installs, with a skip setting available. This warrants a warning for lifecycle-triggered agent setup, but inspected source did not establish a concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package globally through npm, unless VIBE_SKIP_SETUP is set.

Impact

Agent clients may load Vibe's card, skills, hooks, or plugin after installation without a separate setup command.

Mechanism

The postinstall calls setupGlobal, which installs agent surfaces and may register the local Vibe plugin.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/install/global.jsdist/install/plugin.js

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js during installation.
The postinstall proceeds only for global npm installs and can be skipped with VIBE_SKIP_SETUP; it calls setupGlobal().
setupGlobal installs surfaces for detected agent clients, including plugin registration when a client CLI is available.
The installer writes the package's own card, skills, and hook into agent homes.
The plugin setup writes a local Vibe plugin tree and registers it in the personal marketplace while preserving other plugins.

Evidence against

The setup is limited to detected clients and is skipped for non-global installs or when VIBE_SKIP_SETUP is set.
The inspected setup adds the package's own integration; no credential transfer or unrelated agent-setting change was established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

19 flagged

package.jsonView file

Lines 11-51json

11 "skills/",

12 "reviewers/",

13 "hooks/",

14 "scripts/",

15 ".claude-plugin/",

16 ".codex-plugin/",

17 "card.md",

18 "README.md",

19 "LICENSE",

20 "mcpb/",

21 "internal/"

22 ],

23 "engines": {

24 "node": ">=20.12.0"

25 },

26 "scripts": {

27 "build": "tsc -p tsconfig.json && chmod +x dist/cli.js",

28 "typecheck": "tsc --noEmit -p tsconfig.json",

29 "test": "vitest run",

30 "check": "npm run build && npm test",

31 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "dependencies": {

34 "ajv": "^8.17.1",

35 "yaml": "^2.8.1"

36 },

37 "devDependencies": {

38 "@stryker-mutator/core": "^10.0.0",

39 "@stryker-mutator/vitest-runner": "^10.0.0",

40 "@types/node": "^22.19.10",

41 "tsx": "^4.23.5",

42 "typescript": "^5.9.3",

43 "vitest": "^4.1.10"

44 },

45 "license": "MIT",

46 "repository": "https://github.com/su-record/vibe",

47 "keywords": [

48 "harness",

49 "ax",

50 "fde",

51 "forward-deployed-engineer",

mcpb/server/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * vibe for the Claude desktop app — an MCP Bundle server that is nothing but a cable to the

4 * `vibe` CLI. Every tool runs `vibe <command> --json` in the project folder the user picked at

5 * install time (VIBE_PROJECT_DIR) and returns the JSON. The verdict stays in the CLI; this

6 * surface is for the interview, the approval, the judgement and the handoff — not for writing code.

7 *

8 * MCP over stdio is newline-delimited JSON-RPC 2.0. Three methods matter here: initialize,

9 * tools/list, tools/call. No SDK: the protocol subset is small and the bundle stays dependency-free.

dist/core/readerSession.jsView file

Lines 17-57javascript

17}

18export function findSession(key, home, now = Date.now()) {

19 const all = readJson(

dist/core/tree.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { spawnSync } from 'node:child_process';

3import fs from 'node:fs';

4import path from 'node:path';

dist/core/github.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { readJson } from './store.js';

3import { usage } from './errors.js';

4const API =

dist/install/global.jsView file

Lines 1-37javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { packageRoot } from '../core/paths.js';

dist/install/plugin.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ir.cjs', 'knowledge-auto.cjs', 'knowledge-projects.cjs', 'knowledge-lint.cjs', 'knowledge-upkeep.cjs', 'knowledge-journal.cjs', 'retest.cjs', 'journal.cjs', 'obsidian.cjs', 'slice-command.cjs', 'slice-store.cjs', 'slice-guard.cjs']; export const marketplace_name = 'vibe-local'; export function pluginpaths(home = os.homedir()) { return { home, tree: path.join(home, '.config', 'vibe', 'plugin', 'vibe'), marketplace: path.join(home, '.agents', 'plugins', 'marketplace.json'), }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/install/plugin.jsView on unpkg

dist/core/docs/pdf.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core/docs/pdf.js#virtual:normalized:round1View on unpkg

dist/core/inspect.jsView file

•matchType = normalized_sha256 matchedPackage = @su-record/vibe@4.2.1 matchedPath = dist/core/inspect.js matchedIdentity = npm:QHN1LXJlY29yZC92aWJl:4.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High